Privacy Notice

Who we are and what this policy covers

ROCEN is operated by Stuart Anderson as a sole trader. This policy covers the ROCEN website, tester applications and the ROCEN app during its testing programme. For privacy questions, contact [email protected].

ROCEN is responsible for how we use applicant details, account information, support correspondence and service diagnostics. When a business uses ROCEN to manage its customers and work, that business normally decides why those customer records are collected and used. ROCEN processes those records to provide the service for that business. Customers should normally contact the business handling their work about its records; we will help the business respond where appropriate.

Information we process

• Tester registrations: your name, business name, email, trade, device platform, confirmation that you are registering for a UK business, agreement and privacy acknowledgement versions and timestamps, and email verification and onboarding status. We also record hashed beta access codes, their expiry and use, and the account linked to verified testing access. Earlier applications may also include approximate workload and reasons for applying.
• Accounts and business profiles: account identifiers, sign-in information, business and contact details and settings you supply. Authentication is handled using Firebase Authentication.
• Work records: customer contact details and addresses, projects, jobs, appointments, notes, tasks, quotes, invoices, work photos, documents, signatures and completion records that users enter or upload.
• AI requests: the information supplied for the selected AI action, which can include customer names, project descriptions, job notes, tasks and other relevant work details, plus generated responses.
• Support and feedback: correspondence, screenshots and other information you choose to send us.
• Technical information: device/app details, error reports, diagnostic logs, account/company identifiers attached to diagnostics, and information used to authenticate the app and protect backend services.

Please only enter information you are entitled to use. Avoid putting passwords, payment-card details, health information or other unnecessary sensitive personal information into notes, photos or AI requests.

Why we use information

We use information to administer tester registrations, verify email ownership and provide testing instructions; create and maintain accounts; store and synchronise business records; provide the workflows you request; generate documents and AI drafts; respond to feedback; diagnose faults; protect accounts and backend services; and meet applicable legal obligations.

For account and service information, we rely on performing our agreement with the user where applicable. We rely on legitimate interests for administering the testing programme, support, security and improving reliability, balancing those interests against individuals' rights. We may also process information to comply with legal obligations. For customer records processed on behalf of businesses, the business is responsible for identifying its lawful basis and providing appropriate privacy information to its customers.

AI assistance

When you use an AI action, ROCEN sends the information needed for that action through its backend to OpenAI to produce a draft or suggestion. Review the information before requesting assistance, and check generated content before using or sending it. AI drafts can be inaccurate. ROCEN's drafting features do not make decisions about people's legal rights or eligibility for services on your behalf.

OpenAI processes these requests under its API service terms and data controls. Provider-side records may be retained for service operation and abuse monitoring. The applicable retention depends on the API feature and account configuration; the service is not configured as a zero-retention service.

Storage, providers and sharing

ROCEN uses Google Firebase services for authentication, cloud data storage, media storage, backend functions, App Check and Crashlytics. Release builds send crash and error diagnostics to Crashlytics. OpenAI processes requests for AI assistance.

Microsoft 365 processes registration verification and onboarding emails, including recipient email addresses and the message contents. Verification links contain temporary tokens; ROCEN stores token hashes and expiry times. We use request limits and IP-derived identifiers to help prevent automated or repeated registrations.

We do not sell personal information. Information may be available to service providers where needed to operate the service and to authorised people carrying out support or administration. Administrative monitoring may include account activity counts; access to business records must be limited to an appropriate purpose and authorisation.

When you share a PDF, email or other document, the content goes to the recipients and the email/share service you select. Your email app may use its currently selected sender account. Apple processes invitations and beta feedback through TestFlight under its own privacy information.

We may disclose information where legally required or necessary to establish, exercise or defend legal rights.

Permissions and local storage

Camera and photo-library access let you attach images to work records. The bundled photo picker can reference location information associated with photos. Device permissions are controlled through your operating-system settings. ROCEN's current app code does not implement background location tracking.

The app can retain local data or cached records on your device to support its operation. Protect the device and account against unauthorised access. Removing the app does not itself delete cloud records.

International processing

Some providers may process information outside the United Kingdom. The location of one backend service does not mean every provider or copy of the data remains in the UK. ROCEN must use the applicable contractual and transfer safeguards for its providers where required.

Retention and deletion

To request deletion of your ROCEN account and associated business data, see Delete your ROCEN account.

Unsuccessful tester applications will normally be deleted within six months after the relevant testing programme ends, consistent with the existing published policy.

Account and business records are kept while needed to provide the service. You can request account closure or deletion by emailing [email protected]. We will verify the request and explain any information that must be retained for legal reasons or another applicable exception. Requests concerning a business's customer records may need to be handled with that business.

After a verified deletion request, we aim to delete the requested information from ROCEN's active systems within 30 days, unless a legal obligation or applicable exception requires retention. We check your authority over shared business records before deleting them. A request to delete particular information does not necessarily close your account. Where providers retain backups or diagnostic records, removal can take longer: Firebase states that authentication data is removed from live and backup systems within 180 days after deletion is initiated, and Crashlytics retains crash reports and associated identifiers for 90 days before starting removal. We will explain relevant retention exceptions when handling your request.

Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction, portability or object to processing. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Contact [email protected]. You can also complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.

Website cookies and changes

The website does not currently use website analytics or non-essential tracking cookies, as stated in the existing policy. This does not mean the app has no diagnostics: release crash reporting is described above. We will update this policy and any required controls if processing changes.

Last updated: 25 October 2026